Method for dynamically generating function call agreement, medium and electronic equipment

Abstract

The invention discloses a method for dynamically generating a function call agreement, a medium and electronic equipment. The method comprises the following steps: a receiving step: receiving a calling parameter and a preset key, the calling parameter comprising a parameter type and a parameter number; a generation step of generating a random number based on the secret key, the parameter type and the number by using a pseudo random number generation algorithm; a judging step: comparing the random number with a preset value, and entering a first registering step when the random number is greater than or equal to the preset value; and a first registering step: disorganizing the sequence of the plurality of registers, and storing the calling parameters into the corresponding registers. According to the method, the hook program can be interfered, and the development difficulty of malware such as plug-in software is greatly increased while the research and development cost is not increased and the software performance is not lost.

Description

Technical Field

[0001] The present application relates to a method, medium, electronic device, and computer program product for dynamically generating function calling conventions. Background Art

[0002] The function calling convention is a set of rules that define how functions are called and returned in programming (machine language level), and specifies the method and convention for the callee (callee) to accept parameters and return values ​​from the caller (caller).

[0003] Hooking (hooking, hook) and hook technology refer to various technologies that modify or extend the behavior of operating systems, applications, or other components by intercepting function calls, message passing, and event passing between software modules. The code that handles intercepted function calls, events, and messages is called hook code or hook program. Hook programming is often used in malicious code. For example, rookit, as a common hook programming solution, is a variety of tools and technologies that hide the visibility of their own processes by pretending to be system API (application programming interface) call outputs. Game plug-ins also often use hook technology. Since static patches are difficult and not conducive to dynamic updates, plug-ins often use the method of releasing hook codes for key functions (called hook key functions in the industry) to obtain or modify game data.

[0004] See also Figure 1 When compiling, traditional compilers will select standard function calling conventions according to the compilation target. For example, ARM uses AAPCS-ARM Architecture Procedure Call Standard by default. For 32-bit int, registers [W0, W1, W2, W3, W4, W5, W6, W7] are used in order to pass parameters, that is, the parameters are stored in registers. When hooking a function, the hook program often uses the inline hook method to intercept input and output parameters. The principle is to insert the hook code at the beginning and end of the function according to the standard function calling convention to obtain the value in the corresponding register (or stack). Common hook frameworks include xposed, frida, etc.

[0005] Common technologies for fighting against hook codes in the prior art include environment detection (detecting classes and files of hook tools, which requires access to SDK (Software Development Kit)) and packing (fighting against static analysis and debugging, which also requires access to SDK). However, these common technologies will increase R&D costs and reduce software performance. Summary of the invention

[0006] Embodiments of the present application provide a method, medium, electronic device, and computer program product for dynamically generating function call conventions.

[0007] In a first aspect, an embodiment of the present application provides a method for dynamically generating a function calling convention, the method comprising:

[0008] A receiving step, receiving a calling parameter and a preset key, wherein the calling parameter includes a parameter type and a parameter number;

[0009] A generating step, using a pseudo-random number generation algorithm to generate a random number based on the key, the parameter type and the parameter number;

[0010] A determination step, comparing the random number with a predetermined value, and when the random number is greater than or equal to the predetermined value, entering a first storage step;

[0011] The first storage step is to disrupt the order of multiple registers and then store the calling parameters in corresponding registers.

[0012] In a second aspect, an embodiment of the present application provides a computer program product, including computer executable instructions, which are executed by a processor to implement the method for dynamically generating a function calling convention described in the first aspect.

[0013] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having instructions stored thereon, which, when executed on a computer, causes the computer to execute the method for dynamically generating a function calling convention in the first aspect.

[0014] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; one or more memories; the one or more memories storing one or more programs, and when the one or more programs are executed by the one or more processors, the electronic device executes the method of dynamically generating function calling conventions in the above-mentioned first aspect.

[0015] In the fifth aspect, an embodiment of the present application provides a device for dynamically generating a function call convention, the device comprising: a receiving unit, receiving call parameters and a preset key, the call parameters comprising a parameter type and a parameter number; a generating unit, using a pseudo-random number generation algorithm, to generate a random number based on the key, the parameter type and the parameter number; a determining unit, comparing the random number with a predetermined value, and entering a first registration step when the random number is greater than or equal to the predetermined value; the first registration unit, shuffling the order of multiple registers, and then storing the call parameters in the corresponding registers.

[0016] The above-mentioned receiving unit, generating unit, determining unit, and first registering unit may be implemented by a processor having the functions of these modules or units in the electronic device.

[0017] The method for dynamically generating a function calling convention of the present invention is based on the LLVM compiler. Through a key preset during compilation, the parameter passing method of each calling parameter is not fixed, and registers or stacks can be used randomly. In the method of using registers to pass parameters, since the order of registers is disrupted, the registers passed each time are completely different from those in the standard function calling convention, thereby interfering with the hook program, so that the hook program cannot normally obtain parameters.

[0018] The pseudo-random number generation algorithm, shuffling algorithm and key used in the present invention ensure that the calling conventions of different functions in the application are different. For plug-in developers, it is necessary to develop a hook program separately for each function, and recompile after replacing the key without modifying the application code, so that the hook program can be invalidated. Without increasing the R&D cost and losing the software performance, the development difficulty of malicious software such as plug-ins is greatly increased. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram showing the working principle of hook programming in the prior art;

[0020] Figure 2 According to some embodiments of the present application, a block diagram of an electronic device is shown;

[0021] Figure 3 According to some embodiments of the present application, a flow chart of a method for dynamically generating a function calling convention is shown;

[0022] Figure 4 According to some embodiments of the present application, a schematic diagram showing the working principle of interference hook programming during a function call is shown;

[0023] Figure 5 According to some embodiments of the present application, a structural diagram of an apparatus for dynamically generating a function calling convention is shown. DETAILED DESCRIPTION

[0024] Illustrative embodiments of the present application include, but are not limited to, methods, media, electronic devices, and computer program products for dynamically generating function calling conventions.

[0025] The embodiments of the present application will be described in further detail below in conjunction with the accompanying drawings.

[0026] Figure 2 According to some embodiments of the present application, a block diagram of an electronic device is shown.

[0027] like Figure 2As shown, the electronic device 100 may include one or more processors 102, a system motherboard 108 connected to at least one of the processors 102, a system memory 104 connected to the system motherboard 108, a non-volatile memory (NVM) 106 connected to the system motherboard 108, and a network interface 110 connected to the system motherboard 108.

[0028] The processor 102 may include one or more single-core or multi-core processors. The processor 102 may include any combination of a general-purpose processor (CPU) and a special-purpose processor (e.g., a graphics processor, an application processor, a baseband processor, etc.). In an embodiment of the present invention, the processor 102 may be configured to execute the following operations: Figure 2 One or more of the various embodiments shown.

[0029] In some embodiments, the system board 108 may include any suitable interface controller (not shown). Figure 1 ), to provide any suitable interface to at least one of the processors 102 and / or any suitable device or component in communication with the system motherboard 108.

[0030] In some embodiments, the system board 108 may include one or more memory controllers to provide an interface to the system memory 104. The system memory 104 may be used to load and store data and / or instructions 120. In some embodiments, the system memory 104 of the electronic device 100 may include any suitable volatile memory, such as a suitable dynamic random access memory (DRAM).

[0031] The non-volatile memory 106 may include one or more tangible, non-transitory computer-readable media for storing data and / or instructions 120. In some embodiments, the non-volatile memory 106 may include any suitable non-volatile memory such as flash memory and / or any suitable non-volatile storage device, such as at least one of a HDD (Hard Disk Drive), a CD (Compact Disc) drive, and a DVD (Digital Versatile Disc) drive.

[0032] The non-volatile memory 106 may include a portion of storage resources installed on the device of the electronic device 100, or it may be accessible to an external device but is not necessarily a portion of the external device. For example, the non-volatile memory 106 may be accessed over a network via the network interface 110.

[0033] In particular, system memory 104 and non-volatile memory 106 may include a temporary copy and a permanent copy of instructions 120, respectively. Instructions 120 may include instructions that, when executed by at least one of processors 102, cause electronic device 100 to implement the following: Figure 2 In some embodiments, the instructions 120 , hardware, firmware, and / or software components thereof may additionally / alternatively be located in the system board 108 , the network interface 110 , and / or the processor 102 .

[0034] The network interface 110 may include a transceiver for providing a radio interface for the electronic device 100, thereby communicating with any other suitable device (e.g., a front-end module, an antenna, etc.) through one or more networks. In some embodiments, the network interface 110 may be integrated with other components of the electronic device 100. For example, the network interface 110 may be integrated with at least one of the processor 102, the system memory 104, the non-volatile memory 106, and a firmware device (not shown) having instructions. When at least one of the processors 102 executes the instructions, the electronic device 100 implements Figure 2 One or more of the various embodiments shown.

[0035] The network interface 110 may further include any suitable hardware and / or firmware to provide a multiple-input multiple-output radio interface. For example, the network interface 110 may be a network adapter, a wireless network adapter, a telephone modem, and / or a wireless modem.

[0036] In one embodiment, at least one of the processors 102 may be packaged together with one or more controllers for the system motherboard 108 to form a system in package (SiP). In one embodiment, at least one of the processors 102 may be integrated on the same die with one or more controllers for the system motherboard 108 to form a system on a chip (SoC).

[0037] The electronic device 100 may further include an input / output (I / O) device 112 connected to the system motherboard 108. The I / O device 112 may include a user interface to enable a user to interact with the electronic device 100; the design of the peripheral component interface enables the peripheral components to interact with the electronic device 100. In some embodiments, the electronic device 100 further includes a sensor for determining at least one of an environmental condition and location information related to the electronic device 100.

[0038] In some embodiments, I / O devices 112 may include, but are not limited to, a display (e.g., a liquid crystal display, a touch screen display, etc.), speakers, a microphone, one or more cameras (e.g., a still image camera and / or a video camera), a flashlight (e.g., a light emitting diode flash), a keyboard, and a graphics card.

[0039] In some embodiments, the peripheral component interface may include, but is not limited to, a non-volatile memory port, an audio jack, and a power interface.

[0040] In some embodiments, the sensors may include, but are not limited to, gyroscope sensors, accelerometers, proximity sensors, ambient light sensors, and positioning units. The positioning unit may also be part of or interact with the network interface 110 to communicate with components of a positioning network (e.g., global positioning system (GPS) satellites).

[0041] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0042] Program code can be applied to input instructions to perform the functions described in the present invention and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, a system for processing instructions including processor 102 includes any system having a processor such as a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.

[0043] Program code can be implemented with high-level programming language or object-oriented programming language to communicate with the processing system. When necessary, program code can also be implemented with assembly language or machine language. In fact, the mechanism described in the present invention is not limited to the scope of any specific programming language. In either case, the language can be a compiled language or an interpreted language.

[0044] One or more aspects of at least one embodiment may be implemented by instructions stored on a computer-readable storage medium, which, when read and executed by a processor, enables an electronic device to implement the method of the embodiment described in the present invention.

[0045] The method for dynamically generating function calling conventions provided in this application can be applied to Figure 2 In the electronic device 100 shown.

[0046] like Figure 3 As shown, the embodiment of the present application provides a flow chart of a method for dynamically generating a function calling convention. In the receiving step S301, a calling parameter and a preset key are received, and the calling parameter includes a parameter type and a parameter number.

[0047] Specifically, the function input parameters are traversed. Here, the function input parameters refer to the call parameters specified when the function is defined, which are used to receive external data. The types of call parameters are, for example, constants, logical values, arrays, error values, references, functions, etc. The type of each call parameter is fixed, such as a 32-bit floating point number, a 64-bit integer, etc. In addition, each call parameter has its own parameter number, which is fixed.

[0048] The preset key is pre-set by the person using the compiler and can be modified dynamically. The preset key can be the same or different for different call parameters.

[0049] In the generating step S302, a pseudo-random number generating algorithm is used to generate a random number based on the key, the parameter type and the parameter number.

[0050] In this embodiment, the pseudo-random number generation algorithm is, for example, the Mersenne Twister algorithm (mt19937). The Mersenne Twister algorithm is used to generate a random number in the range of 1-100 based on a key, a parameter type, and a parameter number.

[0051] The random number is associated with the key. For different calling parameters, as long as the key is the same, the generated random number is fixed. In other words, the sequence of random numbers is generated according to the key, and this sequence of random numbers is related to the key, so that when the key is the same, the results of two compilations can be guaranteed to be the same.

[0052] In the determination step S303, the random number is compared with a predetermined value. When the random number is greater than or equal to the predetermined value, the first registration step S304 is entered, and when the random number is less than the predetermined value, the second registration step S305 is entered.

[0053] In this embodiment, the random number is, for example, 20. It can be understood that the random number can be any other number without limitation.

[0054] In the first registering step S304, the order of the multiple registers is disrupted, and then the calling parameters are stored in the corresponding registers.

[0055] Specifically, a shuffling algorithm is used to shuffle the order of multiple registers based on a key. As is known, in the shuffling algorithm, it is assumed that a system-provided rand function (i.e., a random function) is provided, and a random number within a given range is provided, and this random process satisfies a uniform distribution within the given range. In this embodiment, the key is used as a random number within the given range. The specific process of the shuffling algorithm is the same as that in the prior art and will not be described in detail here.

[0056] Several registers are within the scope of the standard function calling convention to avoid register corruption. For example, registers within the scope of the standard function calling convention include Figure 1 In this embodiment, the order of these registers is disrupted by using a shuffling algorithm based on a key, for example, Figure 4 Registers shown are [W3, W5, W1, W2, W0, W4, W7, W6].

[0057] In the process of parameter passing, these registers are usually used in order, that is, the call parameters will be stored in the registers of the corresponding order position. For example, the call parameter P1 uses the register in the first position for parameter passing. If the order of these registers is not disrupted, then the call parameter P1 uses register W0 for parameter passing, that is, the call parameter P1 is stored in register W0. In this embodiment, the order of these registers has been disrupted, and the register in the first position is W3, then the call parameter P1 uses register W3 for parameter passing, that is, the call parameter P1 is stored in register W3 in the first position.

[0058] In the second storage step S305, the call parameters are stored in the stack. In this embodiment, when the random number is less than 20, the call parameters are stored in the stack. Figure 4 The random number is stored in the stack 40 shown, rather than in the register. Since the random number is an integer in the range of 0-100, there is a 20% probability of stack parameter transfer. It can be understood that the access speed of the stack is slower than the storage speed of the register.

[0059] Furthermore, the LLVM (Low Level Virtual Machine) compiler is used to implement the above method. The LLVM compiler is used because the IR (Intermediate Representation) mechanism of the LLVM compiler can better support the unified modification of the calling convention in the middle layer without the need to separately handle the backends of different architectures; in addition, the tablegen mechanism of the LLVM compiler is also more convenient for writing calling conventions for different platforms. Tablegen is the code used by the LLVM compiler to develop and maintain the entries of common features in the compiler (such as instruction descriptions, register descriptions), making it an automated tool for flexible description and construction.

[0060] It can be understood that the method of the present invention is also applicable to other compilers without limitation.

[0061] Combination Figure 4The method for dynamically generating function calling conventions of the present invention is based on the LLVM compiler. Through the key preset during compilation, the parameter passing method of each calling parameter is not fixed, and registers or stacks can be used randomly. In the method of using registers to pass parameters, since the order of registers is disrupted, the registers passed each time are completely different from those in the standard function calling convention, thereby interfering with the hook program, making it impossible for the hook program to obtain parameters normally.

[0062] The pseudo-random number generation algorithm, shuffling algorithm and key used in the present invention ensure that the calling conventions of different functions in the application are different. For plug-in developers, it is necessary to develop a hook program separately for each function, and recompile after replacing the key without modifying the application code, so that the hook program can be invalidated. Without increasing the R&D cost and losing the software performance, the development difficulty of malicious software such as plug-ins is greatly increased.

[0063] The invention also provides a device for dynamically generating function calling conventions. Figure 5 is a structural diagram of a device 50 for dynamically generating a function calling convention. Figure 5 As shown, the device 50 includes: a receiving unit 51, receiving call parameters and a preset key, the call parameters including a parameter type and a parameter number; a generating unit 52, using a pseudo-random number generation algorithm, based on the key, the parameter type and the parameter number, to generate a random number; a determining unit 53, comparing the random number with a predetermined value, and when the random number is greater than or equal to the predetermined value, entering a first register unit 54; the first register unit 54, after disrupting the order of multiple registers, stores the call parameters in the corresponding registers.

[0064] It is understandable that the receiving unit 51, the generating unit 52, the determining unit 53, and the first registering unit 54 can be implemented by the processor 102 having the functions of these modules or units in the electronic device 100. The embodiments disclosed in the foregoing are method embodiments corresponding to this embodiment, and this embodiment can be implemented in conjunction with the above-mentioned embodiments. The relevant technical details mentioned in the above-mentioned embodiments are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above-mentioned embodiments.

[0065] The present invention also provides a computer program product, including computer executable instructions, which are executed by the processor 102 to implement the method of dynamically generating function call conventions of the present invention. The implementation methods disclosed in the foregoing are method implementation methods corresponding to the present implementation methods, and the present implementation methods can be implemented in conjunction with the above-mentioned implementation methods. The relevant technical details mentioned in the above-mentioned implementation methods are still valid in the present implementation methods, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in the present implementation methods can also be applied in the above-mentioned implementation methods.

[0066] The present invention also provides a computer-readable storage medium having instructions stored thereon, and when the instructions are executed on a computer, the computer executes the method for dynamically generating a function call convention of the present invention. The implementation methods disclosed in the foregoing are method implementation methods corresponding to the present implementation methods, and the present implementation methods can be implemented in conjunction with the above-mentioned implementation methods. The relevant technical details mentioned in the above-mentioned implementation methods are still valid in the present implementation methods, and in order to reduce repetition, they will not be repeated here. Accordingly, the relevant technical details mentioned in the present implementation methods can also be applied in the above-mentioned implementation methods.

[0067] It should be noted that in the examples and description of this patent, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one" do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0068] Although the present application has been illustrated and described with reference to certain preferred embodiments thereof, it will be apparent to those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present application.

[0069] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0070] It should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those expressly recited in each claim. Rather, as reflected in the claims, inventive aspects lie in less than all of the features of the individual embodiments previously disclosed. Therefore, the claims that follow the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present invention.

[0071] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0072] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims, any one of the claimed embodiments may be used in any combination.

Claims

1. A method for dynamically generating a function calling convention, characterized in that: The method comprises: A receiving step, receiving a calling parameter and a preset key, wherein the calling parameter includes a parameter type and a parameter number; A generating step, using a pseudo-random number generation algorithm to generate a random number based on the key, the parameter type and the parameter number; A determination step, comparing the random number with a predetermined value, and when the random number is greater than or equal to the predetermined value, entering a first storage step; The first registering step is to disrupt the order of multiple registers and then store the calling parameters in corresponding registers.

2. The method according to claim 1, characterized in that In the first registering step, a shuffling algorithm is used to shuffle the order of the plurality of registers based on the key.

3. The method according to claim 1, characterized in that In the determination step, when the random number is less than the predetermined value, the second storage step is entered. Wherein, in the second registering step, the calling parameters are stored in a stack.

4. The method according to claim 1, characterized in that: The random number is associated with the key.

5. The method according to claim 1, characterized in that The plurality of registers are registers within the scope of a standard function calling convention.

6. The method according to claim 1, characterized in that The method is implemented using the LLVM compiler.

7. The method according to claim 1, characterized in that For different calling parameters, the preset keys are the same or different.

8. A computer program product comprising computer executable instructions, characterized in that: The instructions are executed by a processor to implement the method for dynamically generating a function calling convention according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The storage medium stores instructions, which, when executed on a computer, enable the computer to execute the method for dynamically generating a function calling convention according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: one or more processors; one or more memories; The one or more memories store one or more programs, and when the one or more programs are executed by the one or more processors, the electronic device executes the method for dynamically generating function calling conventions as described in any one of claims 1-7.

Images